Hello,
I am imaging a thumbdrive in encase 6. When I good to add device, and add it, I see two different listings for the thumbdrive. See below.
Imaging
- add device
- Local Drive (Where my usb is plugged into.
- I see two drives (amoung others), same size, different sector size
Cntfs
Dntfs
Eusb drive (icon says create a boot disk- doesn't make sense)
0
1
2 my drive. (icon looks like physical hd)
However whenever I do something (enscript scan for partition) the activity light on the usb drives flashes. No I am not using a writeblocker, this is not actual work, just testing.
My question is two fold, 1) Am I right that the "2", instead of "E" is the physical drive? 2) If after I acquired the drive, why is the drive flashing when I run enscripts or searches against the E01 file?
Thanks
The choices on top with drive letters are logical volumes. The choices on the bottom with numbers are physical disks.
So, yes, you selected the physical disk (2).
When you go through the add evidence process that is NOT the same as creating an image. My guess is that you are still working in preview mode which continues to access the physical device until you actually create an image.
Right click on the disk icon in the Tree Pane and choose Acquire. After completing the process, EnCase will no longer be working with the physical attached media, but with the .e01 file you have created.
Hope this helps…..
Thank you so much. That answered my question.